Supplier Verification

The buyer problem

Procurement teams are under pressure to onboard suppliers quickly, but skipping verification creates real exposure: a supplier that turns out to be a shell entity, a financially distressed operation that can't deliver, or a sanctioned party can create financial loss, supply disruption, and regulatory liability. The practical difficulty is that "supplier verification" means different things to different teams: some only check a business registry, others add financial screening, and few consistently screen ownership or sanctions exposure. Buyers need a repeatable process, not an ad hoc one-off check that varies by who happens to run it.

What supplier verification covers

A complete supplier verification process confirms four things before onboarding: that the business is legally registered and in good standing, who ultimately owns and controls it, whether it is financially stable enough to perform the contract, and whether it or its owners appear on any sanctions or watchlist. Depending on volume and risk, this is done via a self-serve verification platform/API, a managed due-diligence service, or a hybrid of both, and is often repeated periodically rather than performed only once at onboarding.

Methods and techniques

• Business registration confirmation against the relevant government registry (Secretary of State, Companies House, or equivalent) to confirm the entity legally exists and is in good standing
• Ultimate beneficial ownership (UBO) identification, tracing ownership through intermediate holding entities to the natural person(s) who ultimately control the business
• Financial stability screening using business credit reports, filed financials, or a proprietary financial-health score to assess the risk the supplier cannot perform the contract
• Sanctions and watchlist screening of the business and its identified owners against government sanctions lists, PEP registers, and adverse media
• Document verification, confirming submitted incorporation documents, tax IDs, and licenses match registry records rather than being self-reported without a cross-check

What to verify before you retain a vendor

• Data source, not just a claim. Ask whether registration and ownership data comes from a direct government-registry connection or a third-party aggregator, and how current that data is.
• Ownership threshold used. Confirm what ownership percentage triggers UBO identification (commonly 25%, matching FinCEN's CDD Rule) and whether a control-person test is applied separately from the ownership test.
• Screening list coverage. Ask which sanctions, PEP, and adverse-media sources are covered, and whether coverage includes non-US lists if you have international suppliers.
• One-time vs. ongoing. Clarify whether the check is a single point-in-time verification or includes ongoing re-screening, and how often re-screening runs.
• Turnaround and escalation. Confirm typical turnaround time for a clean pass versus a flagged result requiring manual review, and what happens next when a flag is raised.

Questions to put in your RFP

1. What government or registry data sources does your verification draw on, and how current is that data?
2. What ownership percentage triggers beneficial-owner identification, and is a separate control-person test applied?
3. Which sanctions, PEP, and adverse-media lists are covered, and do you support non-US jurisdictions?
4. Is this a one-time check, ongoing monitoring, or both, and what does re-screening cost?
5. What is your typical turnaround time, and how are flagged results escalated for manual review?
6. Can you provide a sample verification report or output schema before we commit?

Red flags

• A provider that cannot say which specific registry or data source backs its verification, or claims to verify "globally" with no country-level detail.
• No clear ownership-percentage threshold or beneficial-ownership methodology.
• Sanctions screening described only as "compliant" with no named list sources (OFAC, EU, UN, etc.).
• A provider that guarantees a supplier is "fully verified" or risk-free. No verification process eliminates risk; it reduces uninformed risk.
• No path for human review of a flagged or ambiguous result.

Regulatory references

Real, named regulatory anchors relevant to this category. Listed for context; they do not endorse this index or any vendor, and this is not legal advice. Verify current requirements directly with the issuing agency or your counsel.

CDD Rule

FinCEN Customer Due Diligence Rule. Sets the widely-referenced 25% beneficial-ownership threshold and a separate control-person test for legal-entity customer identification. Directly binding on covered financial institutions; commonly used as a practical benchmark elsewhere.

OFAC SDN List

OFAC Specially Designated Nationals List. The US Treasury's primary sanctions list; screening against it is a baseline component of sanctions-aware supplier verification.

FATF

Financial Action Task Force Recommendations. International standards for customer due diligence and beneficial-ownership transparency (Recommendations 10, 24, 25), referenced by many national verification and AML frameworks.